Hard disk is classified into a plurality of partitions and is thereby managed for efficiently operating a disk. The most representative DOS partition allows partitions to be managed with a partition table and enables to manage a plurality of partitions through an expansion partition concept. In digital forensic, when a partition is deleted, a method in which a user manually finds partition information or analyzes a partition table to recover the deleted partition is used for recovering the deleted partition. This method, however, spends much time in finding deleted partition information because disk is largely scaled in capacity with the advance of hardware, and requires a user's technical skill in manual recovery.
Specifically, a related art for partition recovery checks a disk map provided from a forensic tool and directly, manually adds a deleted partition, or analyzes a Master Boot Record (MBR) and sequentially accesses all sectors to search deleted partition information, thereby recovering the deleted partition. For manual addition, however, a user's technical skill is required, and in the case of a method that sequentially accesses all sectors to search deleted partition information, tens minutes to tens hours are taken according to a disk capacity.
Accordingly, an efficient partition recovery method and apparatus, which provide partition recovery information to a user within early time and manages a recovered partition in hard disk or evidence image, are required.